The Best Software Composition Analysis Software in 2026
We researched software composition analysis software using official websites, including pricing pages, plan tables and product documentation. Rankings consider dependency-risk coverage, core SCA features, value for money and verified capabilities.
Our top picks
-
Top ranked
Snyk Open Source#1 of 659.4/10Broad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.
Free plan
-
Runner-up
FOSSA#2 of 659.3/10A mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.
Free plan
-
Top-ranked free plan
Safeguard SCA#3 of 659.1/10A budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.
Free plan
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
The full ranking 65 tools, best first · page 1 of 2
-
Best forTeams wanting broad SCA coverage
Broad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.
- Reachability analysis
- Pull request scanning
- SBOM generation
9.4/10★★★★★Visit Snyk -
Best forHybrid teams needing mature SCA
A mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.
- Reachability analysis
- Pull request scanning
- SBOM generation
9.3/10★★★★★Visit FOSSA -
Best forBudget-conscious teams needing remediation
A budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.
- Reachability analysis
- Pull request scanning
- SBOM generation
9.1/10★★★★★Visit Safeguard SCA -
Best forLarge enterprises needing broad analysis
Broad SCA coverage for enterprises managing open-source risk across the SDLC.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.9/10★★★★☆Visit Black Duck -
Best forTeams prioritizing reachability and risk
A broad SCA platform for teams that need reachability and risk-based prioritization.
- Reachability analysis
- Pull request scanning
- SBOM generation
Free plan · pricing on request Our Endor Labs verdict → Visit Endor LabsFor vendors Sponsor this spot · #5 · $59/mo →8.8/10★★★★☆Visit Endor Labs -
Best forDeveloper teams needing code-aware SCA
A developer-focused SCA tool combining reachability, SBOMs, detection, and upgrade automation.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.7/10★★★★☆Visit Semgrep -
Best forTeams focused on malicious packages
A focused SCA platform for detecting malicious packages and dependency risk.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.6/10★★★★☆Visit Socket -
Best forEnterprises needing hybrid SCA
A hybrid SCA platform combining dependency risk analysis, SBOM, reachability, and remediation.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.5/10★★★★☆Visit Mend.io -
Best forMature policy-driven organizations
A policy-driven SCA platform with reachability, SBOMs, remediation, and broad ecosystem coverage.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.4/10★★★★☆Visit Sonatype -
Best forOrganizations needing exploitable-path analysis
A broad SCA platform for teams prioritizing reachability and policy automation.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.3/10★★★★☆Visit Checkmarx -
Best forTeams using a broader AppSec platform
A broad SCA toolkit for teams already working across an AppSec platform.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.2/10★★★★☆Visit Veracode -
Best forOrganizations wanting established vendor backing
A broad SCA platform with free access, enterprise controls, and sales-led pricing.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.1/10★★★★☆Visit OpenText -
Best forTeams wanting free broad SCA coverage
Broad SCA coverage with a free tier and deeper controls across paid plans.
- Reachability analysis
- Pull request scanning
- SBOM generation
8.0/10★★★★☆Visit Xygeni -
Best forOrganizations prioritizing software supply-chain threats
A threat-focused SCA platform spanning package analysis, SBOMs, and CI/CD controls.
- Reachability analysis
- SBOM generation
7.9/10★★★★☆Visit ReversingLabs -
Best forTeams needing source and snippet analysis
A broad SCA platform for source, dependency, license, and SBOM workflows.
- Pull request scanning
- SBOM generation
7.8/10★★★★☆Visit FossID -
Best forEmbedded and firmware-heavy teams
Broad firmware and software supply-chain analysis for connected-device teams.
- Reachability analysis
- Pull request scanning
- SBOM generation
7.7/10★★★★☆Visit Finite State -
Best forSmall teams wanting free risk checks
Free SCA checks cover dependency risks, SBOMs and CI workflows across supported ecosystems.
- Pull request scanning
- SBOM generation
7.6/10★★★★☆Visit DepWarden -
Best forTeams needing source and binary SCA
Scantist combines source and binary SCA with SBOMs, reachability, and broader code security.
- SBOM generation
7.5/10★★★★☆Visit Scantist -
Best forJFrog-centered artifact environments
Broad artifact and dependency risk analysis for teams built around JFrog.
- Reachability analysis
- Pull request scanning
- SBOM generation
7.4/10★★★★☆Visit JFrog Xray -
Best forTeams needing scanning plus runtime controls
A broad SCA platform that adds SBOMs, remediation workflows, and Java runtime controls.
- Pull request scanning
- SBOM generation
7.3/10★★★★☆Visit MergeBase -
Best forOpen-source CLI and CI users
A broad, self-hosted SCA CLI for open-source scanning, SBOMs, policies, and CI workflows.
- Reachability analysis
- Pull request scanning
- SBOM generation
7.2/10★★★★☆Visit Bomly -
Best forSelf-hosted teams wanting broad scanners
A broad self-hosted scanner for teams that want open-source dependency and container analysis.
- Reachability analysis
- SBOM generation
7.1/10★★★★☆Visit OWASP dep-scan -
Best forTeams centered on OSV vulnerability data
A flexible OSV-based scanner for teams that can work with CLI and GitHub workflows.
- Reachability analysis
- Pull request scanning
- SBOM generation
7.0/10★★★★☆Visit OSV-Scanner -
Best forOpen-source license compliance teams
A broad, self-hosted toolkit for open-source license, vulnerability, and SBOM workflows.
- SBOM generation
6.9/10★★★☆☆Visit site -
Best forTeams wanting free self-hosted portfolio monitoring
A free self-hosted platform for SBOM inventory, vulnerability analysis, and policy enforcement.
- SBOM generation
6.8/10★★★☆☆Visit site -
Best forContainer and infrastructure scanning users
A broad free scanner for container and infrastructure coverage, without reachability analysis.
- SBOM generation
6.7/10★★★☆☆Visit Trivy -
Best forOffline open-source SCA users
A flexible open-source SCA tool for offline scanning, SBOMs, and CI workflows.
- Pull request scanning
- SBOM generation
6.6/10★★★☆☆Visit OpenSCA -
Best forDevelopers wanting lightweight free SCA
A lightweight, free SCA CLI with broad scanning and policy controls for developer workflows.
- Pull request scanning
- SBOM generation
6.5/10★★★☆☆Visit SafeDep -
Best forTeams customizing open-source scan workflows
A self-hosted SCA server for teams that want configurable scans and CI automation.
- Pull request scanning
- SBOM generation
6.4/10★★★☆☆Visit ScanCode.io -
Best forTeams monitoring a small number of apps
A focused SCA platform for teams monitoring one application with hourly alerts and fix guidance.
- Reachability analysis
- SBOM generation
6.2/10★★★☆☆Visit Vulert -
Best forSmall self-hosted teams
A focused self-hosted SCA tool with a capable free plan and limited ecosystem reach.
- Pull request scanning
- SBOM generation
6.1/10★★★☆☆Visit depproof -
Best forOrganizations centered on SBOM governance
A focused SBOM governance platform with broad generation, monitoring, and compliance workflows.
- SBOM generation
5.9/10★★★☆☆Visit SBOM Observer -
Best forTeams needing broad manifest and image analysis
Broad dependency, container, SBOM, license, and vulnerability analysis for regulated teams.
- SBOM generation
5.8/10★★★☆☆Visit site -
Best forSource and binary component analysis teams
Broad source-and-binary SCA with SBOMs, dependency analysis, and remediation workflows.
- SBOM generation
5.7/10★★★☆☆Visit Revenera -
Best forContainer security and SBOM operations
A broad container and SBOM security platform for teams managing complex software supply chains.
- SBOM generation
5.6/10★★★☆☆Visit Anchore -
Best forCloud infrastructure organizations
A cloud-focused SCA platform with SBOM, dependency, license, and remediation workflows.
5.5/10★★★☆☆Visit IBM Concert -
Best forOrganizations needing broad CI integrations
Broad CI and ecosystem coverage, with paid plans starting at £2,300 per year.
- SBOM generation
5.4/10★★★☆☆Visit Meterian BOSS -
Best forTeams needing integrated code security
A broad SCA toolkit for teams that need security controls across code and pipelines.
- Reachability analysis
- Pull request scanning
- SBOM generation
5.3/10★★★☆☆Visit Cycode -
Best forAI security teams needing embedded SCA
A broad AI security platform that adds reachability-focused SCA to developer workflows.
5.3/10★★★☆☆Visit ZeroPath -
Insignary ClarityVerified
Best forTeams analyzing compiled binaries and source together
Deep source and binary SCA; the main platform is quote-based, with a separate self-service On-Demand SKU from $200.
- Reachability analysis
- SBOM generation
5.3/10★★★☆☆Visit Insignary -
Best forOpen-source teams needing host and container SCA
A flexible self-hosted SCA library with broad ecosystem coverage and a local-scanning focus.
- Reachability analysis
- SBOM generation
5.3/10★★★☆☆Visit OSV-SCALIBR -
Best forPython teams wanting affordable dependency scanning
A focused Python SCA CLI with useful scanning, SBOM, remediation, and CI features.
- Reachability analysis
- SBOM generation
5.3/10★★★☆☆Visit Safety CLI -
Best forFree binary and SBOM vulnerability scanning
A free, self-hosted scanner for binaries, dependencies, SBOMs, and CI workflows.
- Pull request scanning
- SBOM generation
5.3/10★★★☆☆Try CVE Binary Tool -
Best forSmall npm and PyPI teams needing simple SCA
A focused SCA option for small npm and PyPI teams with a useful free tier.
- Pull request scanning
- SBOM generation
5.3/10★★★☆☆Visit OpenHack -
Best forJava and Python teams needing reachability analysis
A focused, self-hosted SCA tool for Java and Python reachability analysis.
- Reachability analysis
5.3/10★★★☆☆Visit Eclipse Steady -
Best forTeams managing container images with Docker
Docker Scout focuses vulnerability analysis, SBOMs, and policy checks on container images.
- SBOM generation
5.3/10★★★☆☆Visit Docker Scout -
Best forOpen-source teams needing lightweight CI SCA
A focused, free SCA scanner for CI teams that need broad dependency and SBOM checks.
- SBOM generation
5.3/10★★★☆☆Visit ts-scan -
Best forTeams needing basic open-source CVE scanning
A practical dependency scanner for basic open-source CVE reporting.
5.3/10★★★☆☆Visit OWASP Tool -
Best forCentralized SBOM lifecycle management
A focused cloud platform for centralized SBOM governance, monitoring, and exchange.
- SBOM generation
5.3/10★★★☆☆Visit SBOM Studio -
Best forTeams focused on container and SBOM vulnerability scans
A focused, free scanner for container, filesystem, package, and SBOM vulnerabilities.
- SBOM generation
5.3/10★★★☆☆Visit Grype
No tools match those filters.
Compare at a glance
| # | Tool | Free plan | Paid from | Supported ecosystems | SBOM generation | Reachability analysis | Pull request scanning | Score |
|---|---|---|---|---|---|---|---|---|
| 1 | Snyk Open Source | Yes | $25/user/mo | C/C++, Dart/Flutter, Elixir, Go, Java/Kotlin, JavaScript, .NET, PHP, Python, Ruby, Rust (limited), Scala, Swift/Objective-C, TypeScript; npm, pnpm, Yarn, Maven, Gradle, Pip, Poetry, pipenv and setup.py | Yes | Yes | Yes | 9.4 |
| 2 | FOSSA | Yes | $20/site/mo | JavaScript/TypeScript, Java/Kotlin, Python, Go, Ruby, Rust, Clojure, Elixir, iOS/Objective-C/Swift, .NET, PHP, Dart, Erlang, Fortran, Haskell, Perl | Yes | Yes | Yes | 9.3 |
| 3 | Safeguard SCA | Yes | $9/mo | npm, PyPI, Maven, Gradle, Go modules, Cargo, RubyGems, Composer, NuGet, Hex | Yes | Yes | Yes | 9.1 |
| 4 | Black Duck SCA | BitBake, Cargo, Carthage, CocoaPods, Conan, Conda, CPAN, CRAN, Dart, Go, Gradle, Hex, Ivy, Lerna, Maven, npm, NuGet, Packagist, PEAR, pip, pnpm, Poetry, RubyGems, SBT, Setuptools, Swift, Yarn, Xcode, OPAM, UV, Rush | Yes | Yes | Yes | 8.9 | ||
| 5 | Endor Labs | Yes | C/C++, Go, Java, JavaScript, Kotlin, .NET (C#), PHP, Python, Ruby, Rust, Scala, Swift, TypeScript, Bazel | Yes | Yes | Yes | 8.8 | |
| 6 | Semgrep Supply Chain | Yes | $30/user/mo | C# (NuGet); Dart (Pub); Go (Go modules); Java (Gradle, Maven); JavaScript/TypeScript (npm, Yarn, pnpm); Kotlin (Gradle, Maven); PHP (Composer); Python (pip, pip-tool, Pipenv, Poetry); Ruby (RubyGems); Rust (Cargo); Scala (Maven); Swift (SwiftPM) | Yes | Yes | Yes | 8.7 |
| 7 | Socket | Yes | $25/user/mo | JavaScript/TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, PHP, Swift, C/C++, Julia, Dart, Elixir/Erlang, GitHub Actions | Yes | Yes | Yes | 8.6 |
| 8 | Mend SCA | No | $1,000/user/yr | C/C++/Conan, C#/.NET/NuGet, Go, Java/Maven/Gradle, JavaScript/npm/yarn/pnpm, PHP/Composer, Python/pip/Poetry/Conda/uv, Ruby/Bundler, Scala/sbt, Swift/SwiftPM/CocoaPods, Rust/Cargo, Haskell/Cabal, Elixir/Erlang/Hex, Bazel, OCaml | Yes | Yes | Yes | 8.5 |
| 9 | Sonatype Lifecycle | No | C++/Conan; Conda; Dart and Flutter/pub; Go/Go Modules; Hugging Face; Java/Maven, Gradle, Ivy; JavaScript/npm, yarn; .NET/NuGet; Objective-C/CocoaPods; PHP/Composer; Python/PyPI, Poetry, pipenv; R/CRAN; RPM/Yum and Fedora EPEL; Ruby/RubyGems and Bundler; Rust/Cargo; Swift/Swift | Yes | Yes | Yes | 8.4 | |
| 10 | Checkmarx SCA | No | Java/Maven, JavaScript/TypeScript/NPM, .NET/NuGet, Python/PIP, PHP/Composer, Swift/iOS, Go, Ruby, C/C++/Conan, Unity, Perl/CPAN, Dart/Pub | Yes | Yes | Yes | 8.3 | |
| 11 | Veracode SCA | C#/.NET (DLL, NuGet); C/C++ (Make); Go (Dep, Glide, go get, Go modules, GoDep, GoVendor, Trash); Java (Ant, Gradle, JARs, Maven); JavaScript (Bower, NPM, Yarn); Kotlin (Gradle, JARs, Maven); Objective-C (CocoaPods); PHP (Composer); Python (pip, Pipenv, Poetry); Ruby (Bundler); Scala (JARs, SBT); Swift (CocoaPods); TypeScript (Bower, NPM, Yarn) | Yes | Yes | Yes | 8.2 | ||
| 12 | OpenText Fortify Software Composition Analysis | Yes | C# / NuGet / Paket; Go / Go Modules / Go Dep / Bazel; Java and Kotlin / Gradle / Maven / Bazel; JavaScript / NPM / Yarn / Bower; Objective-C / CocoaPods; PHP / Composer; Python / Pip / Pipenv / UV / Poetry; Ruby / RubyGems; Rust / Cargo; Swift / CocoaPods; Scala / SBT | Yes | Yes | Yes | 8.1 | |
| 13 | Xygeni | Yes | Maven, Gradle, npm, Yarn, Bower, .NET, Go, Python/Pip, PHP/Composer, Ruby, Dart/Flutter | Yes | Yes | Yes | 8.0 | |
| 14 | ReversingLabs Spectra Assure | Yes | $500/mo | npm, PyPI, RubyGems, NuGet, VS Code, PS Gallery, Docker, Amazon ECR, Hugging Face, Maven, Windows, Linux, macOS, containers, virtual machines | Yes | Yes | 7.9 | |
| 15 | FossID Workbench | JavaScript (NPM, Bower, PNPM, Yarn), Java/Kotlin (Maven, Gradle, Ivy, Kotlin), Python (PIP, Pipenv, Poetry, Hatch), Rust/Cargo, Dart/Flutter, PHP/Composer, Ruby/Bundler, Go, C/C++/Conan, CocoaPods/Swift, Yocto, Soong, Elixir, Haskell, .NET, SBT | Yes | Yes | 7.8 | |||
| 16 | Finite State Platform | C/C++, Rust, Java, Python, JavaScript, Go, Assembly, Swift, Kotlin, C#, PHP, Ruby, Perl, Shell, Scala, Dart, TypeScript, Objective-C; Linux, VxWorks, Windows, macOS, Android, iOS, FreeRTOS, QNX, ThreadX, Zephyr, INTEGRITY, Embedded Linux, Windows IoT, RTEMS; ELF, PE, Mach-O, APK, JAR, WASM, IPA, MSI, DMG, DEB, RPM, TAR, ZIP, OCI, COFF, HEX, BIN | Yes | Yes | Yes | 7.7 | ||
| 17 | DepWarden | Yes | npm, PyPI, Maven, Gradle, Go, RubyGems, Cargo, NuGet, Composer, Dart (Pub), Swift | Yes | No | Yes | 7.6 | |
| 18 | Scantist | Yes | Java, JavaScript, Perl, Go, Python, C#, C/C++, Ruby, PHP, Objective-C, Swift | Yes | 7.5 | |||
| 19 | JFrog Xray | No | Go, PHP, Java/Maven, Java/Gradle, Java/Ivy, Scala/SBT, JavaScript/npm, Bower, pnpm, Yarn, .NET/NuGet, Python/PyPI, Conda, RubyGems, CocoaPods, Conan, Rust/Cargo, R/CRAN, Swift/SwiftPM, Dart/Flutter/pub, Docker, OCI, Helm, Terraform State | Yes | Yes | Yes | 7.4 | |
| 20 | MergeBase | No | Java/Maven/Gradle; .NET/NuGet; Go; JavaScript/NPM/Yarn; PHP/Composer; Elixir/Hex; Python/PIP; Dart/Pub; Ruby/Gem; Swift/Swift Package Manager/CocoaPods; Rust/Cargo; C/C++/CMake/Make/Vcpkg/Conan | Yes | Yes | 7.3 | ||
| 21 | Bomly CLI | Yes | Free | C++, Dart, .NET/NuGet, Elixir, GitHub Actions, Go, Maven, Gradle, npm, pnpm, Yarn, Bun, PHP/Composer, Python/pip/Pipenv/Poetry/uv, Ruby/Bundler, Rust/Cargo, Scala/SBT, Swift/CocoaPods/SwiftPM, plus Syft-backed ecosystems | Yes | Yes | Yes | 7.2 |
| 22 | OWASP dep-scan | Yes | Free | Node.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, YAML manifests | Yes | Yes | 7.1 | |
| 23 | OSV-Scanner | Yes | Free | C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGet | Yes | Yes | Yes | 7.0 |
| 24 | OSS Review Toolkit | Free | Bazel, Conan, Pub, Mix, Rebar3, Gleam, Go Modules, Stack, Gradle, Maven, Tycho, Bower, Bun, NPM, PNPM, Yarn, .NET, NuGet, Carthage, CocoaPods, Swift Package Manager, Composer, PIP, Pipenv, Poetry, Bundler, Cargo, SBT, SPDX, ORT Project, Unmanaged | Yes | 6.9 | |||
| 25 | OWASP Dependency-Track | Yes | Free | Cargo, Composer, Gems, Hex, Maven, NPM, NuGet, PyPI | Yes | 6.8 | ||
| 26 | Trivy | Yes | Free | Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packages | Yes | 6.7 | ||
| 27 | OpenSCA | Yes | Free | Java/Maven, Java/Gradle, JavaScript/NPM, PHP/Composer, Ruby/gem, Golang/Go mod, Rust/cargo, Erlang/Rebar, Python/Pip | Yes | Yes | 6.6 | |
| 28 | SafeDep vet | Yes | Free | npm, PyPI, Maven, Go, Ruby, Rust, PHP; Docker and OCI container images; CycloneDX and SPDX SBOMs | Yes | Yes | 6.5 | |
| 29 | ScanCode.io | Free | npm, PyPI, Maven, NuGet, RubyGems, Cargo, Composer, Conda, Docker; Java, Scala, Kotlin, Groovy, Clojure, JavaScript, TypeScript, Go, Rust, Python, Debian | Yes | Yes | 6.4 | ||
| 30 | Vulert | No | $15/mo | Java, JavaScript, PHP, Python, Go, Rust, Ruby, Dart, C/C++, Elixir, CycloneDX, SPDX | Yes | Yes | 6.2 | |
| 31 | depproof | Yes | Maven, Gradle, npm, pnpm, yarn, bun, PyPI, Go modules | Yes | Yes | 6.1 | ||
| 32 | SBOM Observer | No | €49/user/mo | C/C++/Conan; Dart/Pub; Elixir/Hex; Erlang/Hex; Go; Java/Maven; .NET/NuGet; Node.js/npm; PHP/Composer; Python/PyPI/Pip; Ruby/RubyGems; Rust/Cargo; Swift/CocoaPods | Yes | 5.9 | ||
| 33 | ComplyVigilance SCA | npm, yarn, pip, PyPI, Poetry, Maven, Gradle, NuGet, Cargo, Go Modules, vcpkg, Conan, Pkg.jl, Hardhat, Truffle, Foundry, Docker Hub, OCI registries; C, C++, C#, Java, Python, JavaScript, TypeScript, Go, Rust, Solidity, Julia | Yes | 5.8 | ||||
| 34 | Revenera Code Insight | Yocto, Debian, Conan, C/C++, Conda, Docker, Go, Gradle, Maven, Bower, NuGet, npm, Yarn, Composer, PyPI, RPM, RubyGems, Cargo, CocoaPods, Git repositories, Hugging Face | Yes | 5.7 | ||||
| 35 | Anchore Enterprise | No | RPM, DEB, APK, ALPM, Portage, Microsoft KB patches, C/C++, Dart, .NET, Elixir, Erlang, Go, Haskell, Java, JavaScript, Jenkins Plugins, Lua, Nix, Objective-C, OCaml, PHP, Python, R, Ruby, Rust, Swift, SWI-Prolog, Bitnami, GitHub Actions, Homebrew, Terraform, WordPress plugins | Yes | 5.6 | |||
| 36 | IBM Concert Software Composition Analysis | No | $1,766/unit/mo | 5.5 | ||||
| 37 | Meterian BOSS | Yes | £2,300/yr | Binaries, C/C++, Clojure, Dart/Flutter, Elixir, Generic, Golang, Java/Kotlin/Scala, JavaScript, .NET, NodeJS, Perl, PHP, Python, R, Ruby, Rust, Swift/Objective-C | Yes | 5.4 | ||
| 38 | Cycode SCA | Java; Python; JavaScript/TypeScript; Go; C#; C++; other languages | Yes | Yes | Yes | 5.3 | ||
| 39 | ZeroPath | No | 5.3 | |||||
| 40 | Insignary Clarity | No | $200 one-time | Yes | Yes | 5.3 | ||
| 41 | OSV-SCALIBR | Free | Go, Java, JavaScript, Python, Ruby, .NET, C++, Dart, Erlang, Elixir, Haskell, PHP, R, Rust, Swift, Julia, Lua, Nim, Perl; Alpine/APK, DPKG, RPM, Pacman, Homebrew, MacPorts, Chocolatey, Portage, Nix, Spack, Flatpak, Snap, OPKG, Zypper | Yes | Yes | 5.3 | ||
| 42 | Safety CLI | Yes | $25/mo | Python | Yes | Yes | 5.3 | |
| 43 | CVE Binary Tool | Yes | Free | Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd) | Yes | Yes | 5.3 | |
| 44 | OpenHack Supply Chain | Yes | $20/mo | npm, PyPI | Yes | Yes | 5.3 | |
| 45 | Eclipse Steady | Free | Java, Python, Maven, Gradle | Yes | 5.3 | |||
| 46 | Docker Scout | Yes | Yes | 5.3 | ||||
| 47 | ts-scan | Yes | Free | Maven, Gradle, npm, PyPI, NuGet, Dart, Visual Basic 6, Go, Docker/Syft | Yes | No | No | 5.3 |
| 48 | OWASP Dependency-Check | Yes | Free | Java/Maven, .NET/NuGet, JavaScript/npm/pnpm/yarn, Ruby/Bundler, Go, Python/pip, PHP/Composer, Dart, Swift Package Manager, Perl/CPAN, Elixir | 5.3 | |||
| 49 | SBOM Studio | Yes | 5.3 | |||||
| 50 | Grype | Yes | Free | Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress plugins | Yes | 5.3 |
Head-to-head All 28 comparisons →
- Snyk Open Source vs FOSSA
- Snyk Open Source vs Safeguard SCA
- Snyk Open Source vs Black Duck SCA
- Snyk Open Source vs Endor Labs
- Snyk Open Source vs Semgrep Supply Chain
- Snyk Open Source vs Socket
- Snyk Open Source vs Mend SCA
- FOSSA vs Safeguard SCA
- FOSSA vs Black Duck SCA
Explore other topics All topics →
- AI Tools 303 directories · 8,267 tools ranked AI Writing Tools · AI Video Generators · Text-to-Speech Software
- Web Hosting & Domains 275 directories · 6,107 tools ranked Shared Web Hosting · Managed Cloud Hosting · Dedicated Server Hosting
- Productivity 157 directories · 4,948 tools ranked Note-Taking Apps · Calendar Apps · Project Management Software
- Marketing 135 directories · 3,978 tools ranked SEO Tools · Influencer Marketing Platforms · Email Marketing Software
- Sales & CRM 152 directories · 4,161 tools ranked Real Estate CRM Software · CRM Software · Proposal Software
- Customer Service 55 directories · 1,547 tools ranked Chatbot Builders · Knowledge Base Software · Call Center Software
How we rank software composition analysis software
Every tool on this page was researched by iTechGuides Editors from its official website — pricing pages, plan tables and product documentation. We rank on how well each one does this category's core job, what the free or entry plan includes, and where it falls short. Where we have enough verified facts, the score out of 10 is a rubric — job fit, value and how much we could verify — shown with its breakdown on every tool's page; a tool we have not verified enough to score yet shows its rank without a number. Scores are re-checked when a product changes its plans. Read the full editorial policy, or submit a tool we missed.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Last updated · How we research and update